'''EnCase''' is a family of all-in-one computer forensics suites sold by [[Guidance Software]]. These products include EnCase Enterprise, EnCase Forensic Edition, EnCase eDiscovery, and EnCase Lab Edition. These programs use a proprietary image file format that has been reverse engineered. Users can create scripts, called [[EnScripts]], to automate tasks.

−

=File Format=

+

== History ==

−

Perhaps the '''de facto''' standard for forensic analyses in law enforcement, Guidance Software's EnCase Forensic encase} uses a proprietary format for images, reportedly based on ASR Data's Expert Witness Compression Format. EnCase's Evidence File .E01) format contains a physical bitstream of an acquired disk, prefixed with a '"Case Info" header, interlaced with CRCs for every block of 64 sectors~(32 KB), and followed by a footer containing an MD5 hash for the entire bitstream. Contained in the header are the date and time of acquisition, an examiner's name, notes on the acquisition, and an optional password; the header concludes with its own CRC.

+

Expert Witness (for Windows) was the original name for EnCase (dating back to 1998). More info about this can be found on the Internet Archive [http://web.archive.org/web/19980504153628/http://guidancesoftware.com/] including a demo of the original software [http://web.archive.org/web/19980504153759/http://guidancesoftware.com/data/ewsetup.exe].

−

Encase can store media dat into multiple evidence files, which are called segment files. Each segment file consist of multiple sections. Each section consist of a section start definition. This contains a section type.

+

== File Format ==

+

See [[Encase image file format]]

−

At least from Encase 3 the case info header is contained in the "header" section, which is defined twice within the file and contain the same information.

+

== Hash Databases ==

+

EnCase uses [[MD5]] hashes and stores them in its proprietary [[Encase hash files|Encase hash file format]]; either individually or in a "hash map".

With Encase 4 an additional "header2" section was added. The "header" section now appears only once, but the new "header2" section twice.

+

== See Also ==

+

* [[Encase image file format]]

+

* [[EnScripts]]

+

* [[LinEn]]

+

* WinEn

−

Version 3 of The Encase F introduced an "error2" sections that it uses to record the location and number of bad sector chunks. The way it handles the sections it can't read is that those areas are filled with zero. Then Encase displays to the user the areas that could not be read when the image was acquired. The granularity of unreadable chunks appears to be 32K.

Revision as of 06:24, 21 July 2012

EnCase is a family of all-in-one computer forensics suites sold by Guidance Software. These products include EnCase Enterprise, EnCase Forensic Edition, EnCase eDiscovery, and EnCase Lab Edition. These programs use a proprietary image file format that has been reverse engineered. Users can create scripts, called EnScripts, to automate tasks.

File Format

Hash Databases

EnCase uses MD5 hashes and stores them in its proprietary Encase hash file format; either individually or in a "hash map".
EnCase supports importing hashes from the NSRL, Hashkeeper, and plain MD5 files.